An unauthenticated SQL injection vulnerability in SourceCodester Best House Rental Management System 1.0 allows attackers to compromise database integrity and gain unauthorized access.

The application fails to properly sanitize the username parameter within the login2 function of the admin_class.php file. This allows an unauthenticated attacker to inject malicious SQL commands, enabling unauthorized database operations.

Successful exploitation of this vulnerability allows an attacker to bypass authentication, access sensitive information, modify or delete database records, and potentially achieve full system compromise. Given the CVSS score of 7.3, this represents a significant risk to business continuity and data confidentiality, as the flaw is remotely exploitable without requiring prior user credentials.

Immediate Action: As no official vendor patch is currently available, administrators should immediately restrict access to the application via network-level controls and evaluate the feasibility of migrating to a more secure platform.

Proactive Monitoring: Monitor web server logs for suspicious POST requests to the /ajax.php endpoint, specifically looking for SQL syntax patterns or unexpected characters within the username field.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns, specifically targeting error-based injection strings in POST parameters.

Public Exploit Available: Yes, a public proof-of-concept and technical report exist, attributed to the researcher's write-up on GitHub.

The presence of a public proof-of-concept increases the likelihood of opportunistic exploitation. Organizations currently utilizing this software should treat this as a high-priority risk and implement strict network segmentation or Web Application Firewall protections immediately to mitigate the threat until a permanent fix is addressed by the vendor.